David Young
On Thursday, June 7, the federal government suspended indefinitely the private right of action (“PRA”) under CASL (Canada’s Anti Spam Law), originally scheduled to come into effect July 1, 2017. The government indicated that the provision would be reviewed and potentially amended by the parliamentary committee tasked to conduct the three-year review of CASL under the statutory requirement stipulated in the Act.
Timing for the review has not been stated but it is reasonable to expect that any “new” PRA would be delayed at least 2-3 years.
In suspending the PRA, the government in effect acknowledged that the provision as currently written is problematic and that it could have created significant legal uncertainty for diverse stakeholders, not only as a result of its rules but also due to the fact that some of CASL’s prescriptive rules are ambiguous and potentially contradictory. In its News Release, the government stated that Canadian businesses, charities and nonprofit groups should not have to bear the burden of unnecessary red tape and costs to comply with CASL and implied that, as written, the provision may have caused unintended consequences for parties having legitimate reasons for communicating electronically with third parties.
The suspension of the PRA and its reconsideration within the impending statutory review of the legislation is timely and appropriate. July 1 will be the third anniversary of CASL’s coming into force and is a significant date quite apart from the PRA. Most importantly, it represents the end of CASL’s three-year transition period for implied consents, which provides flexibility for organizations seeking to comply with the law’s complicated–and not easily understood–rules for consent to send “commercial electronic messages” (“CEMs”). The end of the transition period means that organizations will need more rigorous internal record-keeping and due diligence procedures to ensure that they either have the required express or implied consents to send CEMs, or qualify under one or more of the statute’s numerous and often difficult to interpret exemptions.
July 1 also represents the end of a three-year “run-in” period for the legislation during which much-focused analysis of its provisions has been undertaken by stakeholders–both business and not-for-profit–as well as by the designated regulators, primarily the CRTC. All of the designated regulators, including the Office of the Privacy Commissioner and the Competition Bureau (which have specific enforcement jurisdictions under the legislation), have undertaken enforcement actions under the CASL provisions, with the result that there is a growing body of regulatory activity available to guide stakeholders in understanding compliance requirements as well as the consequences of noncompliance.
It may be expected that for all of these reasons the regulators will now be looking to up their game in terms of CASL enforcement and, conceivably, look to the suspension of the PRA as an additional reason for doing so. As has been noted in a previous commentary, the PRA might have served a significant role as a proxy for regulatory enforcement, with the result that in its absence regulators may perceive or expect that their role in promoting CASL compliance is more relevant than ever.
That the statutory review of CASL will now encompass a review and potential amendment of the PRA –before its coming into force –is opportune in that the focused experience of stakeholders in relation to CASL compliance efforts and the concerns identified with the law and the PRA specifically will now have a forum for discussion and legislative input. Concerns with the PRA, voiced by business and nonprofit stakeholders alike, included the liability risks that it posed for them and their directors and officers, even when many were still unclear as to the precise compliance requirements of the legislation. These concerns were magnified by the realization that –far from providing a simple “user-friendly remedy” for private individuals affected by non-compliant practices –the PRA would be a litigation remedy most likely accessible only to well-resourced parties such as class action plaintiffs and their counsel.
Confusion as to the value of the PRA arises when a closer analysis of its procedural rules indicates that, for significant and potentially egregious large-scope incidents, regulatory track enforcement could preempt it. In addition, factors to be considered in any PRA award indicate that its application would have been primarily penal in nature, rather than offering a practicable means for affected persons to claim compensation for harm otherwise difficult to prove in a court of law. All of which suggests that the PRA should be viewed as a proxy for regulatory enforcement rather than an effective private party remedy.
Stakeholders in both the for-profit and not-for-profit sectors had argued strenuously that the PRA was unnecessary as an additional regulatory enforcement tool. They submitted that enforcement has been very effective to date. Furthermore, it was argued that the potential negative impacts of the PRA for small and medium-sized organizations including the potential risks that they would face notwithstanding their best intentions to comply with the law, far outweighed any benefit from a compliance perspective.
The one stakeholder group likely disappointed with the PRA suspension will be the class action plaintiff’s bar –whom it has been suggested were counting the days until they could launch claims. However, closer analysis of how the provision would have played out in practice suggests that any anticipated onslaught of claims may have been exaggerated.
The statutory review of CASL is important because all aspects of the law now will be under review and potentially adjusted to reflect the experience and the concerns articulated by stakeholders during its first three years. To have determined that some provisions of the law should be clarified if not amended substantively as a result of this review, without delaying the PRA –which potentially could have provided a basis for claims under those very provisions –would have been illogical.
David Young Law • Hudson’s Bay Centre, Suite 3500, 2 Bloor Street East, Toronto, ON M4W 1A8T. 416-968-6286 • M. 416-318-5521
Privacy and Regulatory Law Counsel • davidyounglaw.ca
Originally published on The Lawyer’s Daily – www.thelawyersdaily.ca
